Most major banks are victims of ATM fraud scams being spearheaded by foreigners using specialized equipment and techniques

The bank is the safest place to keep your money, right? Well, not quite. The emergence of hi-tech fraud that targets Automatic Teller Machines (ATMs) has caused fear and alarm in the banking fraternity.  Late last month, the police arrested four Bulgarian men in a Kampala suburb on allegations of operating an ATM skimming scam.

The miscreants are yet to be formally charged because of the complexity of the investigations involved. Police say the problem is worse than what is reported in the media - banks are suffering silently but are reluctant to report the fraud for fear of losing their customers. Experts fear that unless something is done urgently, Uganda might soon become “a haven” for foreign fraudsters.

Experts say cyber crime has been on an upward trend in recent years, but Ugandans are particularly getting more worried following the arrest of the Bulgarians whose entry into the country is also shrouded in mystery.  This, they fear, is making local ATMs susceptible to international fraudsters whose methods of work are far more sophisticated than local financial institutions can deal with in a bid to safeguard their customers’ money. With the number of banks now standing at 25 and operating a total of almost 640 ATMs that are scattered around the country, banks are obviously uncomfortable. Most worryingly, the incidence of cyber crime is expected to rise and more so since there are no sufficient mechanisms to check it due to an insufficient legal framework and poor monitoring systems.

This is how the scam works. When you insert your card, a secret gadget will quickly skim your card and send the data via a wireless system to the fraudster in the vicinity. As you type your PIN on the keypad, another secret device on the keypad or secret camera will capture the digits.  With all the information to operate your account in his hands, the fraudster will be able to clone another ATM card and withdraw money at any ATM.  Fraudsters reportedly operate at night or very early in the morning particularly at ATMs in secluded locations.

ATM fraud has been rampant all over the world given the increasing availability of ATM-skimming equipment on the market. Besides, ATM fraud is easy and not as troublesome as other forms of fraud. In many developed countries, magnetic stripe technology ATM cards, which almost every Ugandan holds, are being phased out and being replaced with chip-microprocessor cards, which are more protected from fraud. A chip card contains a microprocessor that uses encryption to prevent its contents from being fraudulently tampered with.  Compared to a magnetic stripe card, a chip card is able to store more personal data plus other details that uniquely identify the card and the cardholder, thus making the card nearly foolproof.

Experts warn that while developed countries have reached an advanced stage in the management of ATM fraud, the African financial system has been very slow to deal with the scourge because of its tendency to be “reactive rather than proactive.”  Unfortunately, Ugandan financial institutions are yet to show what plans they have to safeguard their customers’ money.

The few banks that The Independent talked to did not appear to give any indication that they will upgrade anytime soon. Centenary Bank, for example, is merely replacing the Personal Identification Numbers (PINs) of its customers.

Fabian Kasi, the executive director, said “all their ATMs are equipped with anti-skimmers” - gadgets that disable any copying of information from their customers’ ATM cards. The bank is also one of the few that have installed Closed Circuit Television (CCTV) cameras at their ATMs plus alarm systems. Some banks such as Global Trust, have also introduced systems that send an instant SMS to a customer’s phone every time a transaction takes place on the account - enabling the customer to alert the bank in case of a fraudulent activity on his/her account.  But experts say fraudsters particularly foreigners, have the experience and technology that will always beat all these measures.

According to the Police, an increasing number of Ugandans are losing money from their accounts through ATMs. What aggravates the situation is the fact that banks are reluctant to disclose that they are under attack by ATM fraud syndicates, because they do not want to give the impression that their customers’ money is not being kept securely, which might scare away of existing and potential customers.

Additionally, the involvement of accomplices or bank employees - who manage the critical operations of the ATM systems - have also given more cause for concern.

“Banks don’t want to report such cases but most of the major ones have been victims,” said Ibn Ssenkumbi, the Kampala Metropolitan Police publicist.

The fraudsters, he said, attach electronic gadgets on the ATM, which copy the details of a customer, which they then use to fabricate another ATM card for use as long as they want.  Ssenkumbi said they are investigating a number of cases where customers have been defrauded at different banks. He says more than 50% of the complaints registered have to do with ATM transactions.  Most the major banks, including Bank of Baroda and Barclays Bank were unwilling to discuss the issue with The Independent.

Way forward

Installing computerized systems to monitor the performance of their ATM outlets as well as offering more specialized training to security guards at ATMs could be the starting point, according to Ssenkumbi.

But David Ssekadde, an administrator with SEK Security Services, a private security company in Kamwokya, said a security guard might be of little help when it comes to cyber crimes. “Mostly cyber crimes happen when somebody hacks into the bank’s information system, so it a question of insecure IT systems,” he said, adding that it is the weaknesses in the bank’s information systems that have to be addressed.

He added that it is negligent of banks to place ATM outlets in insecure and risky locations without full-time security. Also, some customers don’t know the proper way to use ATMs, which puts their money in the hands of fraudsters.

Electronic crime is a relatively new concept in Uganda. And according to the police, most of the culprits are unscrupulous foreigners who are using devices that are miles ahead of internal controls and security systems used by local banks. Poor internal risk management and controls within the banks is what needs to be addressed.

David Bakibinga, a prosecutor with the Directorate of Public Prosecutions, cites lack of proper legislation as another challenges facing the fight against cyber crime in the country.  Additionally, the country lacks cyber forensics - the application of scientifically proven methods to process, interpret and utilize digital evidence - which means cyber crime cannot be effectively prosecuted without effective investigation. Also, there is lack of cyber crime knowledge on the part of prosecutors, which hampers effective prosecution.  For instance, the four Bulgarians are yet to appear in court because the Police are trying to enlist the assistance of International Police (Interpol) to get in touch with the authorities in Bulgaria.  However, there is therefore a fear that the case might fall through if the Bulgarians opt to shield their nationals.  This is because successful investigation and prosecution of international criminals requires mutual assistance from other jurisdictions as evidence from foreign jurisdictions may be required to prove a case. For example, it is said the Bulgarians committed similar crimes in Kenya but were acquitted for unknown reasons. Evidently, the lack of harmonization of substantive international criminal laws could shield foreigners from law enforcement in that they can go unpunished because they have the efforts of other countries to protect their citizens.

The arrest of the Bulgarians came only a fortnight after a special unit, the Computer Emergency Response Team (CERT) under the Uganda Communications Commission (UCC), was launched as one of the strategies to fight cyber crime in the country. Last year, the government enacted the Electronic Transactions Act and the Electronic Signatures Act and the Computer Misuse Act to prevent cyber crime. However, the laws are yet to be operationalised by the National Information Technology Authority Uganda (NITA-U), though they are obviously urgent.

In the meantime, the agency has urged financial institutions to strengthen their security systems as they are working with police to operationalize the cyber laws, which would impact on a cross-section of stakeholders and a great number of enterprises.

“We are working with the Police to make the regulations of cyber laws, namely Electronic Transactions Act, the Electronic Signature Act and Computer Misuse Act,” said Charlotte Ampaire, the NITA-U PRO, but quickly adding that banks need to be aware that technology keeps evolving all the time.

As ATM fraud is forcing banks in developed countries to migrate from magnetic stripe cards, it remains to be seen how long it will take Ugandan financial institutions to upgrade their systems given their fear of incurring the costs of installing the systems and compatible ATMs.

But in the meantime, all customers need to do is to be more cautious as anyone can be a target of ATM fraudsters who also use stolen ATM cards, credit cards as well as smart phones, which are increasingly being used for financial transactions.

Bakibinga particularly points to lack of awareness on the part of the public about the threat of cyber crime; as a key challenge as well as the reluctance of institutions to report incidents of cyber crime to law enforcement agencies, which he says could negatively impact the fight against the vice.

“It is important to note that the threat of cyber crime is real and should be tackled before it goes out of hand, otherwise Uganda may become a cyber crime haven,” he warned.

Analysts say security alone cannot combat ATM fraud. There is a need for banks to work together and more so since ATMs of different banks are increasingly becoming more interconnected. This means that banks and security institutions must share information and devise strategies for a joint effort to combat ATM fraud.

It is not clear how customers will respond to these concerns as they wait for their banks to upgrade their systems, but one customer told The Independent that she would keep their ATM card at home and revert to over- the-counter transactions.

Tips on safeguarding your cash at ATMs

• Keep your ATM card safely and change your PIN regularly
• Notify the bank immediately when you lose your ATM card
• Don’t accept ‘assistance’ from strangers when at an ATM
• Minimise use of the ATM, particularly at secluded locations
• Avoid being the last or the first to use an ATM
• Notify the bank when you notice unfamiliar gadgets attached on the ATM
• Be wary of suspicious activities/people at an ATM
• Notify the bank as soon as you notice an authorized transaction on your account

Comments (3)

Subscribe to this comment's feed

Name

Email

Website

Title

Comment

smaller | bigger

I have read and agree to the Terms of Usage.

Add Comment Preview